jarredhj0214 opened a new pull request, #12671:
URL: https://github.com/apache/gravitino/pull/12671

   ### What changes were proposed in this pull request?
   
   This PR updates authorization denial messages generated by 
`GravitinoInterceptionService` to show the full `NameIdentifier` of the denied 
metadata object instead of only the last segment.
   
   For example, a table authorization failure now reports metadata like:
   
   ```text
   metalake.catalog.schema.table
   instead of:
   table
   A unit test is added to cover multi-segment NameIdentifier rendering in the 
no-auth response.
   Why are the changes needed?
   When different catalogs or schemas contain metadata objects with the same 
name, showing only NameIdentifier.name() makes authorization failures harder to 
diagnose.
   Showing the full NameIdentifier helps users identify the exact denied 
resource directly from the 403 error message.
   Fixes #12670
   Does this PR introduce any user-facing change?
   Yes. The diagnostic text in 403 authorization denial messages changes from 
the last metadata name segment to the full NameIdentifier.
   This does not change authorization logic, HTTP status codes, error response 
structure, response fields, or user permissions.
   How was this patch tested?
   Added a unit test in TestGravitinoInterceptionService to verify that 
authorization denial messages include the full metadata NameIdentifier.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to